Cyclops Blink

MITRE ATT&CK: S0687 View on attack.mitre.org

Aliases: Cyclops Blink

First seen
2019-01-01 00:00:00
Malware type
botnet, worm
Family
Malware family
Operating systems
network-devices
Related IoCs
25
Last IoC activity
2026-04-15 04:40:48
Profile updated
2026-07-07 14:23:54

Targeted industries: technology-and-telecommunications government-and-public-sector

Context

Cyclops Blink is a modular malware that has been used in widespread campaigns by Sandworm Team since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. Cyclops Blink is assessed to be a replacement for VPNFilter, a similar platform targeting network devices.

Detection coverage

  • 6 YARA rules
  • 260 Sigma rules

Malware & tools used

  • Native API (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Timestomp (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Component Firmware (attack-pattern)
  • Data from Local System (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Process Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Non-Standard Encoding (attack-pattern)
  • Multi-hop Proxy (attack-pattern)
  • Inter-Process Communication (attack-pattern)
  • Network Device Firewall (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Web Protocols (attack-pattern)
  • RC Scripts (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • Non-Standard Port (attack-pattern)

Used by threat actors

Detection rules

  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings (yara-rule)
  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation (yara-rule)
  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade (yara-rule)
  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers (yara-rule)
  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values (yara-rule)
  • SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command (yara-rule)

Reports & references

  • Trend Micro — Cyclops Blink Sets Sights On Asus Routers (report)
  • ncsc.gov.uk — Joint Advisory Shows New Sandworm Malware Cyclops Blink Replaces Vpnfilter (report)
  • MITRE ATT&CK — S0687 (report)
  • ncsc.gov.uk — Cyclops Blink Malware Analysis Report (report)

External references